Evolving security policies

As computer system size and complexity grow, formulating effective policies require more sophistication. There are many risk factors that need to be considered, some of which may be in conflict. Inevitably, unpredictable circumstances that demand decisions will arise during operation. In some cases an automated response may be imperative; in other cases these may be ill-advised. Manual decisions are often made that override the current policy and serve effectively to redefine it. This matter is further complicated in highly dynamic operational environments like mobile ad-hoc networks, in which the risk factors may be changing continually. Thus, security policies must be able to change and adapt to the operational needs. This study investigates the potential of evolutionary algorithms as a tool in determining the optimal security policies that suit such environments. This thesis reviews some fundamental concepts in related domains. It presents three applications of evolutionary algorithms in solving problems that are of direct relevance. These include the inference of security policies from decision examples, the dynamic adaptation of security policies, and the optimisation of security policies for a specific set of missions. The results show that the inference approaches based on evolutionary algorithms are very promising. The thesis concludes with an evaluation of the work done, the extent to which the work justifies the thesis hypothesis and some possible directions on how evolutionary algorithms can be applied to address a wider range of relevant problems in the domain of concern.